Hubiyaha CORS

Fahanka Siyaasadda CORS iyo Doorkeeda Amniga

Cross-Origin Resource Sharing (CORS) waa hab amni oo ay adeegsadaan browser-yada si ay u xaddidaan codsiyada HTTP ee ka imaanaya meel ka baxsan asalka rasmiga ah ee server-ka. Marka koodhka ku dhex jira browser-ka uu isku dayo inuu akhriyo jawaab ka timid server kale, browser-ku wuxuu si adag u eegaa madaxyada (headers) HTTP ee jawaabtaas si uu u go'aamiyo haddii la oggol yahay helitaanka xogta.

Qalabkani wuxuu kaa caawinayaa inaad fahamto haddii browser-ku uu oggolaan lahaa codsi gaar ah oo ka yimid asal kale, iyadoo la raacayo madaxyada HTTP ee aad bixiso iyo faahfaahinta codsigaaga. Waxaad ku dhejin kartaa madaxyada jawaabta, ka dibna waxaad cayimi kartaa asalka (origin), habka (method), iyo madaxyada codsiga (request headers), iyo haddii aqoonsiga (credentials) lagu daray iyo haddii kale. Qalabku wuxuu falanqeynayaa xeerarka wuxuuna soo saarayaa go'aanka saxda ah ee browser-ku qaadan lahaa.

Sida Loo Adeegsado Hubiyaha CORS

Si aad u hubiso siyaasadda CORS, raac tillaabooyinkan adoo isticmaalaya qaybaha gelinta ee qalabka:

1. Jawaab celin la siiyay hubinta: Dooro inta u dhaxaysa "Jawaabta dhabta ah" ama "Jawaabta hubinta hordhaca ah".
2. HTTP jawaabaha madaxda: Ku dheji madaxyada HTTP ee ka soo baxay server-ka. Haddii aad hubinayso jawaabta preflight-ka, hubi inaad ku dhex darto xariiqda xaaladda (status line). Gelistani waxay qaadi kartaa ugu badnaan 200,000 oo xarfo.
3. Asalka codsiga: Geli scheme-ka, martida (host), iyo ikhtiyaarka port-ka ee asalka codsanaya (tusaale: https://app.example.com). Waa inuu ahaadaa asal saafi ah ama null, iyadoo aan la oggolayn URL path, query, ama aqoonsi.
4. Habka la codsaday: Geli habka HTTP ee la isticmaalayo (sida GET, POST, ama OPTIONS).
5. Magacyada madaxa la codsaday: Geli magacyada madaxyada laga soo qaatay Access-Control-Request-Headers, adoo u kala saaraya commas ama xariijimo (tusaale: Content-Type, Authorization).
6. Ku dar aqoonsiga: Shid toggle-kan haddii codsigaagu uu ku darayo cookies ama xaqiijinta HTTP (HTTP authentication).

Markaad geliso faahfaahinta, qalabku wuxuu falanqeynayaa madaxyada isagoo soo bandhigaya go'aanka browser-ka iyo sababaha keenay go'aankaas.

Xeerarka Go'aaminta iyo Saameynta Aqoonsiga (Credentials)

Marka la falanqeynayo siyaasadda CORS, xeerarka ayaa isbeddela iyadoo la raacayo haddii aqoonsiga (credentials) lagu daray codsiga iyo haddii kale:

• Marka aqoonsiga lagu daro:
  • Madaxa Access-Control-Allow-Origin ma noqon karo wildcard *. Waa inuu si sax ah ula jaanqaado asalka codsaday.
  • Madaxa Access-Control-Allow-Credentials waa inuu si sax ah u ahaadaa true.
  • Wildcards (*) ee loo adeegsado hababka la oggol yahay (Access-Control-Allow-Methods) iyo madaxyada la oggol yahay (Access-Control-Allow-Headers) waxay lumiyaan macnahooda wildcard-nimo.
• Marka aan aqoonsiga lagu darin:
  • Wildcard * waa la isticmaali karaa si loo oggolaado hababka iyo madaxyada oo dhan, marka laga reebo madaxa Authorization.
  • Madaxa Access-Control-Allow-Credentials ma saameynayo go'aanka browser-ka.

Haddii madaxa Access-Control-Allow-Origin uu leeyahay qiimo ka badan hal ama uu yahay mid lagu kala saaray commas, waxaa loo tixgelinayaa inuu yahay mid aan sax ahayn.

Doorka Duulimaadka Hore (Preflight Requests)

Codsiyada qaarkood waxay u baahan yihiin hubin hordhac ah (preflight request) oo adeegsata habka OPTIONS ka hor inta aan la dirin codsiga dhabta ah. Inta lagu jiro habkan:

• Server-ku waa inuu soo celiyo xaalad HTTP oo guulaysatay oo 2xx ah. Haddii aan xariiqda xaaladda HTTP lagu darin jawaabta la dhejiyay, xaaladda preflight-ka lama hubin karo (indeterminate).
• Habka la codsaday waa inuu ku jiraa Access-Control-Allow-Methods ama uu ahaadaa hab ka mid ah kuwa CORS-safelist ah oo aan u baahnayn oggolaansho gaar ah.
• Madaxa Authorization waa in si cad loogu qoraa gudaha Access-Control-Allow-Headers; xitaa haddii la isticmaalo Access-Control-Allow-Headers: *, taasi ma daboolayso madaxa Authorization.

Xaddidaadda Falanqeynta iyo Amniga Xogta

Qalabkani wuxuu falanqeynta ku sameeyaa si toos ah browser-kaaga dhexdiisa. Madaxyadaada iyo faahfaahinta codsigaaga marnaba looma soo gudbiyo server kale, waxbana laguma keydiyo BroBroGo.

Fadlan ogow in qalabkani uu kaliya hubiyo madaxyada jawaabta iyo faahfaahinta codsiga ee aad adigu gelisay. Ma la xiriirto server-ka, ma akhriyo URL-yo, ma dejiyo cookies, mana hubiyo DNS ama TLS. Sidoo kale, natiijada guuleysata ee halkan lagu muujiyo ma dammaanad qaadayso in codsiga tooska ah uu shaqeyn doono, sababtoo ah ma xisaabiso leexinta (redirects), jawaabaha kaydsan (cached responses), isbeddelka xeerarka server-ka, kordhinta browser-ka (browser extensions), ama jawaabta dhabta ah ee ka dambaysa preflight-ka.

Su'alaha Badanaa La Is Weydiiyo (FAQ)

Ma ku dhejiyaa jawaabta dhabta ah mise jawaabta ka hor duulimaadka?
Isticmaal jawaabta dhabta ah si aad u hubiso in koodhka browser-ka uu akhriyi karo hal jawaab. Isticmaal jawaabta Preflight si aad u hesho jawaabta OPTIONS ee ansixisa hab dambe iyo magacyada madaxa codsan.

Maxay wildcard u fashilmi kartaa iyadoo la adeegsanayo aqoonsi?
Marka cookies-ka ama aqoonsiga HTTP lagu daro, asalka la oggol yahay waa inuu si sax ah ula jaanqaado asalka codsada. Wildcards loogu talagalay hababka la oggol yahay iyo headers-ka sidoo kale waxay lumiyaan macnaha wildcard-kooda.

Natiijada gudbinta ma caddeynaysaa codsiga tooska ah inuu shaqeyn doono?
Maya. Natiijadan waxay daboolaysaa oo kaliya jawaabta la dhejiyay iyo faahfaahinta codsiga ee halkan lagu geliyay. Leexinta, jawaabaha kaydsan, beddelka xeerarka server-ka, kordhinta browser-ka iyo jawaabta dhabta ah ee ka dib preflight wali waxay beddeli karaan natiijada.

Sidee loola tacaalaa madaxa Authorization marka la isticmaalayo wildcard?
Madaxa Authorization waa in si cad loogu qoraa gudaha Access-Control-Allow-Headers. Xitaa haddii aad isticmaasho Access-Control-Allow-Headers: *, taasi ma daboolayso madaxa Authorization oo wuu fashilmi doonaa haddii aan si gaar ah loo qorin.